A message posted to Handala Hack, the group's Telegram channel, showed pictures and videos of the bouquets appearing just outside voting centres, along with several letters.  Reuters
A message posted to Handala Hack, the group's Telegram channel, showed pictures and videos of the bouquets appearing just outside voting centres, along with several letters. Reuters

Iran-linked Handala hacking group sends bouquets and letters to Israel polling sites

Cody Combs

Handala, a hacking group that US authorities say is linked to Iran, says it placed bouquets of flowers with "sensitive items" at various polling sites in Israel as the country votes in one of its most anticipated elections in years.

A message posted to Handala Hack, the group's Telegram channel, showed pictures and videos of the bouquets appearing just outside voting centres, along with several letters.

"Just moments ago, Handala operatives successfully planted a package containing a bouquet of flowers, a message, and a special letter signed by Asif Sarmad, commander of Handala’s Popular Resistance Front, deep inside the occupied territories, right at the heart of Gadi Eisenkot’s hideout," the Telegram message read.

It was referring to referring to the former military chief of staff seeking to unseat Israeli Prime Minister Benjamin Netanyahu.

"The package has now reached the former commander, a clear and mocking message to those who have feared our shadows for years and still entertain illusions of security," the message continued.

Handala warned that "in the coming hours", more packages from the hacking group might also be discovered.

The Iran-linked Handala hacking group boasted of placing bouquets near various Israel polling locations on its Telegram channel.
The Iran-linked Handala hacking group boasted of placing bouquets near various Israel polling locations on its Telegram channel.

"Other bouquets have been quietly placed at the heart of your polling stations," read Telegram message.

There was no indication that the bouquets posed any sort of threat.

For more than a year, Handala has claimed responsibility for various cyber security-related issues and apparent hacks around the world.

In March, the Iran-linked group followed through on a threat to attack the FBI by hacking director Kash Patel's personal email and cloud services.

Hours after making the threat, Handala posted apparent photos of Mr Patel traveling and an old CV with his personal contact information.

In a statement at the time, the FBI said it was aware of malicious entities looking to breach Mr Patel's digital assets.

"We have taken all necessary steps to mitigate potential risks associated with this activity," the statement read.

"The information in question is historical in nature and involves no government information."

In March, the US seized several web assets it says belonged to the Iran-backed Handala hacking group.
In March, the US seized several web assets it says belonged to the Iran-backed Handala hacking group.

The bureau said that the State Department at the time was offering up to a $10 million reward for information leading to the identification of the Handala hackers.

It was later determined that Handala was responsible for a cyber attack against Michigan-based medical technology company Stryker, which has more than 50,000 employees around the world.

In March, the US Justice Department seized websites operated by Handala, but it does not seem to have affected the hacking group's operations.

Handala's Telegram channel has been removed several times for breaching the platform's terms of service and other rules, only for the group to re-emerge later with a newly activated account.

Updated: October 27, 2026, 6:17 PM